REMARKS 

The application includes claims 1-20 and 22-31 prior to entering this amendment. 
The Applicant amends claims 1, 2, 4-12, 14-20, 22, and 24-3 1 , and cancels claims 
3, 13, and 23 without prejudice. 

Claim 21 was previously caacelled. 

The Applicant adds new claims 32-35. No new matter is added. 
The application remains with claims 1, 2, 4-12, 14-20, 22, and 24-35 after 
entering this amendment. 

Allowable Subject Matter 

The Examiner objected to claims 7 and 8 as being dependent upon a rejected base 
claim, but indicated that they would be allowable if rewritten in independent form. 
Applicant thanks the Examiner for the indication of allowable subject matter and the 
proposed amendment. 

While Applicant agrees with the Examiner that these claims are allowable, 
Applicant respectfully declines to amend claims 7 and 8 on the basis that the independent 
1 , upon which they depend, is itself allowable. 

Claim Rejections - 35 U.S.C, § 101 

The Examiner rejected claims 1 1-20 and 22-31 under 35 U.S.C. § 101. 

Without admitting the propriety of the rejection, Apphcant amends claimsl 1, 12, 
14-20, 22, and 24-31, and cancels claims 13 and 23 to expedite prosecution, and without 
prejudice with regard to pursuing the claims as previously presented or in other forms in 
a continuation or other application. 

In rejecting claim 1 1 , the Examiner stated that "All of the claim limitations are 
directed towards method steps that are carried out in software (page 4, final paragraph of 
the Office Action). Claim 1 1 is amended to recite a storage device and one or more files 
stored on the storage device. According to the Federal Circuit decision In re Nuiiten , 500 
F.3d 1346 (Fed. Cir. Sept. 20 2007) which noted the reversal of the Examiner's § 101 
rejection of a claim comprising a storage mediimi which "nominally puts the claim into 
the statutory category of 'manufacture'." Applicant respectfully submits that the 
patentable features recited by amended claim 1 1 are supported by statutory basis, and 
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furthermore are consistent with the USPTO's own Interim GxiideUnes for Examination of 
Patent Applications for Patent Subject Matter EUgibiUty. 

The Examiner rejected claim 31 on the basis that the recited computer readable 
instructions are not "embodied in a computer-readable medium" (page 3, final 
paragraph). Applicant amends claim 31 to recite, in part a tangible computer readable 
medium having stored therein computer readable instructions. Accordingly, the rejection 
is believed to be moot. 

Applicant respectfully requests withdrawal of the rejection of claims 11, 12, 14- 
20, 22, and 24-31. 

Claim Rejections - 35 U.S.C. § 102 

The Examiner rejected claims 1-2, 6, 9-12, 16, 19-20, 22, 26, and 29-31 under 35 
U.S.C. § 102(e) over Cowie, et al. (U.S. Patent Application Publication No. 
2003/0023865). 

The rejection is traversed; however, Applicant amends claims 1-2, 6, 9-12, 16, 19- 

20, 22, 26, and 29-31 to expedite prosecution, and without prejudice with regard to 

pursuing the claims as previously presented or in other forms in a continuation or other 

application. Amended claim 1 recites a method, comprising: 

obtaining a signature by reading code comprising a partial section 
of a steganographic program, wherein the steganographic program is 
configured to introduce steganographic items into a computer file; 

comparing the signature with one or more computer files; and 
displaying a listing of which of the one or more computer files 
provide a match with the signature. 

Cowie is directed to detecting computer programs such as Trojans and worms 

using fingerprints derived from unpacked resource data in the packed computer files 
which are being searched (Abstract). A library of such fingerprints are generated from 
known Trojans and worms which are compared with the fingerprint for the packed file 
(paragraph 0048). 

AppUcant first remarks that the Trojans and worms of Cowie fail to disclose 
either the steganographic program or the steganographic items recited by claim 1 . 
Furthermore, Applicant respectfully submits that Cowie fails to disclose obtaining a 

signature by reading code comprising a partial section of a steganographic program, as 
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recited by claim 1 . According to Cowie, fingerprint data indicative of predetermined 
characteristics of resource data are used to compare the suspect file with the library of 
Trojans and worms (paragraph 0012). The actual code of the suspect file is not used as a 
signature, rather Cowic's fingerprint is comprised of data indicia such as the data check 
sum or time stamp (paragraphs 0015-0018). 

Additionally, Cowie teaches away fi-om reading any code by describing that in 
order to read the actual code of the packed files, one would have to decompress the files 
(paragraphs 0005). Cowie discloses that his data indicia may be identified without 
decompressing the files and therefore, it follows that that data indicia is determined 
without reading any code (paragraph 00012). 

Claims 1 1 and 3 1 are believed to be allowable for at least some of the reasons 
provided above witii respect to claim 1. As claims 2, 6, 9, 10, 12, 16, 19-20, 22, 26, 29, 
and 30 depend firom claim 1 , 11 , or 3 1 , they are believed to be patentable over the art for 
at least the foregoing reasons, as well as for tiie fijrther novel features recited respectively 
therein. Accordingly, withdrawal of the rejection of claims 1-2, 6, 9-12, 16, 19-20, 22, 
26, and 29-31 is respectfully requested. 

Claim Rejections - 35 U.S.C. § 103 

The Examiner rejected claims 3-5, 13-15, and 23-25 under 35 U.S.C. § 103(a) 
over Cowie and Pierre Richer (Sans/GIAC Practical Assignment for GSEC Certification 
Version 1.4b). 

In rejecting original claim 3, now cancelled, the Examiner acknowledged that 
Cowie fails to disclose steganographic items, and instead suggested that Richer discloses 
these features. 

Richer is directed to an overview of steganalysis and of several software 
appUcations available to perform a forensic analysis. Specifically, at pages 4 and 5, 
Richer provides a Usting of the various methods of performing steganalysis. Richer fails 
to disclose any specific or detailed description of how these methods operate. Evaluation 
of the conventional systems are described as matching a hash value of suspected files 
(page 6) or compressibility of the files (page 8) to identify some difference between an 
original file and an original file which has been modified with steganographic items. 
Each of these methods look to data indicia, similar to Cowie, to identify when an original 
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file has been modified. Accordingly, Richer fails to cure the deficiencies previously 
identified for Cowie. 

As claims 4, 5, 14, 15, 24, and 25 depend fi-om claim 1, 11, or 31, they are 
believed to be patentable over the art for at least the foregoing reasons, as well as for the 
further novel features recited respectively therein. Accordingly, withdrawal of the 
rejection of claims 4, 5, 14, 15, 24, and 25 is respectfixUy requested. 



The Applicant adds new claims 32-35 for consideration. No new matter is added. 

Any statements made by Examiner that are not addressed by AppUcant do not 
necessarily constitute agreement by the Applicant. In some cases. Applicant may have 
amended or argued the allowability of independent claims thereby obviatmg grounds for 
rejection of the dependent claims. 



For the foregoing reasons, the Applicant respectfiiUy requests reconsideration and 
allowance of all pending claims. The Examiner is encouraged to telephone the 
undersigned if it appears that an interview would be helpfiil in advancing the case. 
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